[Bro-Dev] Call for opinions on logging framework syntax problem
Gregor Maier
gregor at icir.org
Wed Nov 30 11:46:30 PST 2011
On 11/30/11 8:32 , Robin Sommer wrote:
>
> On Tue, Nov 29, 2011 at 19:04 -0800, you wrote:
>
>> orig_p.port orig_p.proto
>
> Hmm ... I like that too but it breaks when ports are in sets/vectors,
> and it gets ugly with ports in records. We could do it just for
> top-level fields but that would be quite inconsistent.
Yeah. I can see sets, vectors being a problem, however, wouldn't it
break in the same way as sets/vectors of record types?
For ports in records it would just be:
cid.orig_p.port cid.orig_p.proto
That doesn't seem to bad.
--
Gregor Maier
<gregor at icir.org> <gregor at icsi.berkeley.edu>
Int. Computer Science Institute (ICSI)
1947 Center St., Ste. 600
Berkeley, CA 94704, USA
http://www.icir.org/gregor/
More information about the bro-dev
mailing list